Method and system for authenticating a drone swarm, and electronic device

Abstract

The application discloses a kind of unmanned aerial vehicle swarm authentication method, system and electronic equipment, and authentication method includes: based on cluster head unmanned aerial vehicle, the domain identifier information of the domain of control machine is calculated The domain identifier key of the domain of cluster head unmanned aerial vehicle and the domain identifier key of control machine are distributed to cluster head unmanned aerial vehicle and control machine;Based on the domain identifier key of the domain of cluster head unmanned aerial vehicle and the terminal identifier information of same cluster member unmanned aerial vehicle, the terminal identifier key of same cluster member unmanned aerial vehicle is calculated, and is distributed to same cluster member unmanned aerial vehicle;Based on the domain identifier key of the domain of cluster head unmanned aerial vehicle and the terminal identifier information of cluster head unmanned aerial vehicle, the terminal identifier key of cluster head unmanned aerial vehicle is calculated, and is distributed to cluster head unmanned aerial vehicle;Communication receiver receives the authentication protocol data packet sent by communication initiator;Communication receiver carries out authentication based on the domain identifier information, terminal identifier information in authentication protocol data packet, preset authentication method with accompanying public key selection.This application improves the security of unmanned aerial vehicle swarm.

Description

Technical Field

[0001] This invention relates to the field of unmanned aerial vehicle (UAV) technology, and more specifically to a method, system, and electronic device for authenticating UAV swarms. Background Technology

[0002] Currently, with the rapid development of drone technology, the application scope of drone swarms in both military and civilian fields is expanding. A drone swarm consists of a controller and multiple drone clusters. A drone cluster includes a cluster leader drone and multiple member drones. Member drones within the same cluster maintain communication connections with the cluster leader drone, while each cluster leader drone communicates with the controller, thereby achieving overall coordinated operation of the swarm.

[0003] However, under the existing technological framework, drones in a drone swarm generally lack identity authentication mechanisms. This vulnerability provides an opportunity for hackers to easily launch malicious attacks on individuals or the entire drone swarm, thereby seriously threatening the operational security and data integrity of the drone swarm and reducing its security.

[0004] Therefore, how to provide a drone swarm authentication method, system, and electronic device that can ensure the safe operation of drone swarms in complex environments and prevent unauthorized access and malicious manipulation is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method, system and electronic device for authenticating drone swarms.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] Firstly, a method for authenticating drone swarms is provided, comprising the following steps:

[0008] S1: Calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV;

[0009] The domain identifier key of the controller is calculated based on the domain identifier information of the domain to which the controller belongs, and then distributed to the controller.

[0010] S2: Calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster.

[0011] The terminal identification key of the cluster head UAV is calculated based on the domain identification key of the domain to which the cluster head UAV belongs and the terminal identification information of the cluster head UAV, and then distributed to the cluster head UAV.

[0012] S3: The communication receiver receives the authentication protocol data packet sent by the communication initiator; wherein, the authentication protocol data packet includes domain identification information, terminal identification information, accompanying public key, communication message and signature; the communication initiator is a cluster head UAV, a member UAV or a controller; the communication receiver is a cluster head UAV, a member UAV or a controller.

[0013] S4: The communication receiver performs authentication based on the domain identifier information, terminal identifier information, and accompanying public key in the authentication protocol data packet, and selects a preset authentication method.

[0014] Preferably, S1 specifically includes the following steps:

[0015] The domain identifier information of the domain to which the cluster head UAV belongs is input into a query function defined by the key management center to obtain the domain identifier key of the domain to which the cluster head UAV belongs. Specifically, when the query function queries a private key matrix, the domain identifier private key of the domain to which the cluster head UAV belongs is obtained; when the query function queries a public key matrix, the domain identifier public key of the domain to which the cluster head UAV belongs is obtained. The domain identifier private key and the domain identifier public key of the domain to which the cluster head UAV belongs are combined to form the domain identifier key of the domain to which the cluster head UAV belongs.

[0016] Preferably, S1 further includes the following steps:

[0017] The domain identifier information of the domain to which the controller belongs is input into a query function defined by the key management center to obtain the domain identifier key of the controller; wherein, when the query function queries the private key matrix, the domain identifier private key of the controller is obtained; when the query function queries the public key matrix, the domain identifier public key of the controller is obtained; the domain identifier private key and the domain identifier public key of the controller are combined to form the domain identifier key of the controller.

[0018] Preferably, S2 specifically includes the following steps:

[0019] Multiply the self-selected private key factor of the drone in the same cluster by the base point to obtain the self-selected public key factor of the drone in the same cluster.

[0020] Multiply the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone;

[0021] The accompanying public key of the cluster member drone is obtained by adding the self-selected public key factor of the cluster head drone and the hidden public key factor of the cluster member drone.

[0022] The association public key of the cluster member drone and the terminal identification information of the cluster member drone are concatenated, hashed, and then moduloed by the third value to obtain the identity and association public key binding coefficient of the cluster member drone; wherein, the third value is the order of the cyclic group of the base point;

[0023] The first value is obtained by multiplying the identity of the cluster member drone with the accompanying public key binding coefficient and the domain identifier private key of the domain to which the cluster member drone belongs; wherein, the domain identifier private key of the domain to which the cluster member drone belongs is the same as the domain identifier private key of the domain to which the cluster head drone belongs in the same cluster.

[0024] The first value, the self-selected private key factor of the drone in the same cluster, and the hidden private key factor of the drone in the cluster head are added together to obtain the second value.

[0025] The second value is modulo the third value to obtain the terminal identifier private key of the drone in the same cluster;

[0026] Multiply the private key of the terminal identifier of the drone in the same cluster by the base point to obtain the public key of the terminal identifier of the drone in the same cluster; wherein, the private key of the terminal identifier of the drone in the same cluster and the public key of the terminal identifier of the drone in the same cluster are combined to form the terminal identifier key of the drone in the same cluster.

[0027] Preferably, S2 specifically includes the following steps:

[0028] Multiply the self-selected private key factor of the cluster head UAV by the base point to obtain the self-selected public key factor of the cluster head UAV.

[0029] Multiply the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone;

[0030] The cluster head drone's self-selected public key factor and the cluster head drone's hidden public key factor are added together to obtain the cluster head drone's accompanying public key.

[0031] The association public key of the cluster head UAV and the terminal identification information of the cluster head UAV are concatenated, hashed, and then moduloed by the third value to obtain the binding coefficient between the identity of the cluster head UAV and the association public key; wherein, the third value is the order of the cyclic group of the base point.

[0032] The fifth value is obtained by multiplying the identity of the cluster head drone with the accompanying public key binding coefficient and the domain identifier private key of the cluster head drone.

[0033] The sixth value is obtained by adding the fifth value, the self-selected private key factor of the cluster head drone, and the hidden private key factor of the cluster head drone.

[0034] The sixth value is modulo the third value to obtain the terminal identification private key of the cluster-head UAV;

[0035] Multiply the terminal identifier private key of the cluster head UAV by the base point to obtain the terminal identifier public key of the cluster head UAV; wherein, the terminal identifier private key and the terminal identifier public key of the cluster head UAV are combined to form the terminal identifier key of the cluster head UAV.

[0036] Preferably, S4 specifically includes:

[0037] If the domain identifier information of the authentication protocol data packet is empty, the terminal identifier information is not empty, and the accompanying public key is not empty, then the intra-domain authentication method is used for intra-domain authentication; wherein, intra-domain authentication refers to authentication between two drones belonging to the same drone cluster;

[0038] The intra-domain authentication method specifically includes the following steps:

[0039] The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key.

[0040] The communication receiver multiplies the identity of the communication initiator with the binding coefficient of the accompanying public key and the domain identifier public key of the domain to which the communication initiator belongs, and then adds the binding coefficient to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator; wherein, the domain identifier public key of the domain to which the communication initiator belongs is the same as the domain identifier public key of the domain to which the cluster head UAV in the same cluster belongs.

[0041] The receiving party uses the public key of the terminal identifier of the initiator to decrypt the signature and obtain the first digest;

[0042] The communication receiver performs a hash operation on the communication message to obtain a second digest;

[0043] The communication receiver compares the first digest and the second digest to see if they match. If they match, the authentication is successful.

[0044] Preferably, S4 also includes:

[0045] If the domain identifier information, terminal identifier information, and accompanying public key of the authentication protocol data packet are not empty, then cross-domain authentication is performed using the cross-domain authentication method; where cross-domain authentication refers to authentication between two drones belonging to different drone clusters.

[0046] The cross-domain authentication method specifically includes the following steps:

[0047] The communication receiver directly or indirectly inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs;

[0048] If the communication receiver is a member drone, the communication receiver sends the domain identifier information in the authentication protocol data packet to the cluster head drone in the same cluster. The cluster head drone inputs the information into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs. The cluster head drone then sends the domain identifier public key of the domain to which the communication initiator belongs to the communication receiver.

[0049] If the communication receiver is a cluster-headed UAV, the communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs.

[0050] The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key.

[0051] The communication receiver multiplies the identity of the communication initiator and the binding coefficient of the accompanying public key with the domain identifier public key of the domain to which the communication initiator belongs, and then adds it to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator.

[0052] The receiving party decrypts the signature using the public key of the terminal identifier of the initiator of the communication to obtain a third digest;

[0053] The communication receiver performs a hash operation on the communication message to obtain a fourth digest;

[0054] The communication receiver compares the third digest and the fourth digest to see if they match. If they match, the authentication is successful.

[0055] Preferably, S4 also includes:

[0056] If the domain identifier information of the authentication protocol data packet is not empty, the terminal identifier information is empty, and the accompanying public key is empty, then the inter-domain authentication method is used for inter-domain authentication; where inter-domain authentication refers to the authentication between the controller and the cluster head UAV.

[0057] The inter-domain authentication method is specifically as follows:

[0058] The communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs;

[0059] The receiving party decrypts the signature using the domain identifier public key of the domain to which the initiator of the communication belongs, and obtains the fifth digest;

[0060] The communication receiver performs a hash operation on the communication message to obtain a sixth digest;

[0061] The communication receiver compares the fifth digest and the sixth digest to see if they match. If they match, the authentication is successful.

[0062] In a second aspect, an authentication system for a drone swarm is provided to implement the authentication method described in the first aspect, comprising a first computing and distribution unit, a second computing and distribution unit, a third computing and distribution unit, a fourth computing and distribution unit, and an authentication unit.

[0063] The first calculation and distribution unit is used to calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV;

[0064] The second calculation and distribution unit is used to calculate the domain identifier key of the controller based on the domain identifier information of the domain to which the controller belongs, and distribute it to the controller;

[0065] The third calculation and distribution unit is used to calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster.

[0066] The fourth calculation and distribution unit is used to calculate the terminal identification key of the cluster head drone based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the cluster head drone, and distribute it to the cluster head drone.

[0067] The authentication unit is used to receive authentication protocol data packets sent by the communication initiator, and to perform authentication based on the domain identification information, terminal identification information, and accompanying public key in the authentication protocol data packets by selecting a preset authentication method.

[0068] Thirdly, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the drone swarm authentication method described in the first aspect.

[0069] As can be seen from the above technical solutions, compared with the prior art, the present invention discloses an authentication method, system and electronic device for drone swarms, which can ensure the safe operation of drone swarms in complex environments and prevent unauthorized access and malicious manipulation. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0071] Figure 1 This is a flowchart of an authentication method for a drone swarm provided in an embodiment of the present invention;

[0072] Figure 2 This is a schematic diagram of a drone swarm provided in an embodiment of the present invention;

[0073] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0074] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0075] It should be noted that: a drone swarm consists of a controller and several drone clusters; each drone cluster consists of a cluster leader drone and several member drones; each cluster leader drone in the same drone swarm is connected to the controller; each cluster leader drone in the same drone cluster is connected to each member drone; and each member drone in the same drone cluster is connected to each other in pairs.

[0076] A drone swarm consists of two levels of security domains: the controller and the individual cluster leader drones form the first level of security domain; the individual drone clusters form the second level of security domain.

[0077] Figure 2 A drone swarm 200 is shown, which includes a controller and three drone clusters: drone cluster 210, drone cluster 220 and drone cluster 230;

[0078] The drone cluster 210 includes a cluster leader drone 211, member drones 212, member drones 213, member drones 214, and member drones 215;

[0079] The drone cluster 220 includes a cluster leader drone 221, member drones 222, member drones 223, and member drones 224;

[0080] The drone cluster 230 includes a cluster leader drone 231, member drones 232, member drones 233, and member drones 234;

[0081] Figure 2 In this system, the controller, cluster head UAV 211, cluster head UAV 221, and cluster head UAV 231 constitute the first-level security domain; UAV cluster 210 constitutes the second-level security domain; UAV cluster 220 constitutes the second-level security domain; and UAV cluster 230 constitutes the second-level security domain.

[0082] Firstly, such as Figure 1 As shown in the figure, an embodiment of the present invention discloses an authentication method for a drone swarm, comprising the following steps:

[0083] S1: Calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV;

[0084] In one or more embodiments, S1 specifically includes the following steps:

[0085] The domain identifier information of the domain to which the cluster head UAV belongs is input into a query function defined by the key management center to obtain the domain identifier key of the domain to which the cluster head UAV belongs. Specifically, when the query function queries a private key matrix, the domain identifier private key of the domain to which the cluster head UAV belongs is obtained; when the query function queries a public key matrix, the domain identifier public key of the domain to which the cluster head UAV belongs is obtained. The domain identifier private key and the domain identifier public key of the domain to which the cluster head UAV belongs are combined to form the domain identifier key of the domain to which the cluster head UAV belongs.

[0086] The domain identifier key of the controller is calculated based on the domain identifier information of the domain to which the controller belongs, and then distributed to the controller.

[0087] In one or more embodiments, S1 further includes the following steps:

[0088] The domain identifier information of the domain to which the controller belongs is input into a query function defined by the key management center to obtain the domain identifier key of the controller; wherein, when the query function queries the private key matrix, the domain identifier private key of the controller is obtained; when the query function queries the public key matrix, the domain identifier public key of the controller is obtained; the domain identifier private key and the domain identifier public key of the controller are combined to form the domain identifier key of the controller.

[0089] It is understandable that all drones within the same drone cluster share the same domain identifier key, which is the domain identifier key of the domain to which the cluster head drone belongs;

[0090] It is understood that: the Key Management Center (KMC) is deployed within the control unit; the cluster leader drone stores the domain identifier information of its domain and its own terminal identifier information; the control unit stores the domain identifier information of its domain; and the member drones store their own terminal identifier information.

[0091] The key management center (KMC) of the controller autonomously selects system parameters a, b, G, n, and p, and specifically defines the cubic equation of the elliptic cryptography algorithm (ECC) as follows: The definitions of each system parameter are shown in Table 1:

[0092] Table 1

[0093]

[0094] The product of the private key matrix and the base point G is the public key matrix;

[0095] In one or more embodiments, the query function performs the following functions:

[0096] The query function concatenates the domain identifier information IDu and the initial vector IV, then performs a hash operation (using the SM3 hash function) to obtain the bit string h(ID||IV). The first L=k*2 bits of the bit string h(ID||IV) are then processed. k Divide the given bits evenly into k sub-bit strings, such that the length of each sub-bit string is 2. k ;

[0097] Counting from left to right, extract the element in the m-th column and S(m)-th row of the public (private) key matrix based on the m-th sub-bit string; where S(m) is the decimal number obtained by converting the m-th sub-bit string to a decimal number and then adding 1; m = 1, 2, ..., k;

[0098] The sum of k elements extracted from the public (private) key matrix is ​​the domain identifier public (private) key.

[0099] The private key matrix is ​​uniquely generated and secretly stored by the Key Management Center (KMC) and is used to generate the domain identifier private key; the public key matrix is ​​uniquely determined by the private key matrix and distributed to each domain (i.e., distributed to each UAV cluster head) for the generation and querying of the domain identifier public key.

[0100] S2: Calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster.

[0101] In one or more embodiments, S2 specifically includes the following steps:

[0102] Multiply the self-selected private key factor of the drone in the same cluster by the base point to obtain the self-selected public key factor of the drone in the same cluster.

[0103] Multiply the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone;

[0104] The accompanying public key of the cluster member drone is obtained by adding the self-selected public key factor of the cluster head drone and the hidden public key factor of the cluster member drone.

[0105] The association public key of the cluster member drone and the terminal identification information of the cluster member drone are concatenated, hashed, and then moduloed by the third value to obtain the identity and association public key binding coefficient of the cluster member drone; wherein, the third value is the order of the cyclic group of the base point;

[0106] The first value is obtained by multiplying the identity of the cluster member drone with the accompanying public key binding coefficient and the domain identifier private key of the domain to which the cluster member drone belongs; wherein, the domain identifier private key of the domain to which the cluster member drone belongs is the same as the domain identifier private key of the domain to which the cluster head drone belongs in the same cluster.

[0107] The first value, the self-selected private key factor of the drone in the same cluster, and the hidden private key factor of the drone in the cluster head are added together to obtain the second value.

[0108] The second value is modulo the third value to obtain the terminal identifier private key of the drone in the same cluster;

[0109] Multiply the private key of the terminal identifier of the drone in the same cluster by the base point to obtain the public key of the terminal identifier of the drone in the same cluster; wherein, the private key of the terminal identifier of the drone in the same cluster and the public key of the terminal identifier of the drone in the same cluster are combined to form the terminal identifier key of the drone in the same cluster.

[0110] In one or more embodiments:

[0111] Cluster member drones randomly generate their own private key factor usk u ;

[0112] Cluster member drones compute their own public key factor upk u =usk u ×G; where G represents the base point;

[0113] A member drone in the same cluster sends a terminal identification key request to the cluster head drone; wherein, the terminal identification key request includes the terminal identification information ID of the member drone in the same cluster. u and custom public key factor UPK u ;

[0114] After receiving the terminal identification key request, the cluster-head UAV randomly generates a hidden private key factor hsk. u (Specifically, the key is randomly generated by the KGC key generation center of the cluster head drone).

[0115] Cluster-headed drones calculate hidden public key factor hpk u =hsk u ×G;

[0116] The cluster leader drone computes the accompanying public key APK of other drones in the same cluster. u =upk u +hpk u ;

[0117] The cluster leader drone calculates the identity of its cluster member drones and the binding coefficient v of their accompanying public key. u =h SM3 (ID u ||apk u )mod n; where h SM3 represents the SM3 hash function; || represents concatenation; mod represents the modulo operation; n represents the order of the cyclic group of the base point;

[0118] The cluster leader drone calculates the distributed private key (dsk) of its cluster member drones. u =hsk u +v u× rsk mod n; where rsk represents the domain identifier private key of the domain to which the cluster member drone belongs (i.e., the domain identifier private key of the domain to which the cluster head drone belongs).

[0119] The cluster-headed drone will distribute the private key dsk u and accompanying public key APK u Send drones belonging to the same cluster;

[0120] Cluster member drones calculate the terminal identifier private key sk of the cluster member drones. u =dsk u +usk u ;

[0121] Formula for determining drones within the same cluster (apk) u +v u ×P KGC =sk u If ×G is valid, then accept the terminal identifier private key sk. u And calculate the terminal identifier public key pk of the drones in the same cluster. u =apk u +v u ×P KGC Among them, P KGCThis represents the domain identifier public key of the domain to which the drone in the same cluster belongs (i.e., the domain identifier public key of the domain to which the cluster head drone belongs).

[0122] The terminal identification key of the cluster head UAV is calculated based on the domain identification key of the domain to which the cluster head UAV belongs and the terminal identification information of the cluster head UAV, and then distributed to the cluster head UAV.

[0123] In one or more embodiments, S2 specifically includes the following steps:

[0124] Multiply the self-selected private key factor of the cluster head UAV by the base point to obtain the self-selected public key factor of the cluster head UAV.

[0125] Multiply the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone;

[0126] The cluster head drone's self-selected public key factor and the cluster head drone's hidden public key factor are added together to obtain the cluster head drone's accompanying public key.

[0127] The association public key of the cluster head UAV and the terminal identification information of the cluster head UAV are concatenated, hashed, and then moduloed by the third value to obtain the binding coefficient between the identity of the cluster head UAV and the association public key; wherein, the third value is the order of the cyclic group of the base point.

[0128] The fifth value is obtained by multiplying the identity of the cluster head drone with the accompanying public key binding coefficient and the domain identifier private key of the cluster head drone.

[0129] The sixth value is obtained by adding the fifth value, the self-selected private key factor of the cluster head drone, and the hidden private key factor of the cluster head drone.

[0130] The sixth value is modulo the third value to obtain the terminal identification private key of the cluster-head UAV;

[0131] Multiply the terminal identifier private key of the cluster head UAV by the base point to obtain the terminal identifier public key of the cluster head UAV; wherein, the terminal identifier private key and the terminal identifier public key of the cluster head UAV are combined to form the terminal identifier key of the cluster head UAV.

[0132] In one or more embodiments:

[0133] Cluster-headed drones randomly generate their own private key factor usk w ;

[0134] Cluster-head drones calculate self-selected public key factor upk w =usk w ×G; where G represents the base point;

[0135] Cluster-headed drones randomly generate hidden private key factors hsk w (Specifically, the key generation center KGC of the cluster head UAV randomly generates the key.)

[0136] Cluster-headed drones calculate hidden public key factor hpk w =hsk w ×G;

[0137] Cluster-head drone computation accompanying public key apk w =upk w +hpk w ;

[0138] Cluster-head drones calculate identity and associated public key binding coefficient v w =h SM3 (ID w ||apk w ) mod n; where h SM3 represents the SM3 hash function; || represents concatenation; mod represents the modulo operation; n represents the order of the cyclic group of the base point;

[0139] Cluster-head drone computes and distributes private key dsk w =hsk w +v w× rsk mod n; where rsk represents the domain identifier private key of the cluster head drone;

[0140] Cluster-headed drone computing terminal identifier private key sk w =dsk w +usk w ;

[0141] Cluster head drone identification formula apk w +v w ×P KGC =sk w If ×G is valid, then accept the terminal identifier private key sk. w And calculate the terminal identifier public key pk w =apk w +v w ×P KGC Among them, P KGC This represents the domain identifier public key of the cluster-head UAV.

[0142] S3: The communication receiver receives the authentication protocol data packet sent by the communication initiator; wherein, the authentication protocol data packet includes domain identification information, terminal identification information, accompanying public key, communication message and signature;

[0143] The communication initiator is a cluster head UAV, a member UAV, or a control unit; the communication receiver is a cluster head UAV, a member UAV, or a control unit.

[0144] It is understood that the authentication protocol data packet includes the domain identifier information of the domain to which the communication initiator belongs, the terminal identifier information, the accompanying public key, the communication message, and the signature.

[0145] S4: The communication receiver performs authentication based on the domain identifier information, terminal identifier information, and accompanying public key in the authentication protocol data packet, and selects a preset authentication method.

[0146] In one or more embodiments, S4 specifically includes:

[0147] If the domain identifier information of the authentication protocol data packet is empty, the terminal identifier information is not empty, and the accompanying public key is not empty, then the intra-domain authentication method is used for intra-domain authentication; wherein, intra-domain authentication refers to authentication between two drones belonging to the same drone cluster;

[0148] The intra-domain authentication method specifically includes the following steps:

[0149] The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key.

[0150] The communication receiver multiplies the identity of the communication initiator with the binding coefficient of the accompanying public key and the domain identifier public key of the domain to which the communication initiator belongs, and then adds the binding coefficient to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator; wherein, the domain identifier public key of the domain to which the communication initiator belongs is the same as the domain identifier public key of the domain to which the cluster head UAV in the same cluster belongs.

[0151] The receiving party uses the public key of the terminal identifier of the initiator to decrypt the signature and obtain the first digest;

[0152] The communication receiver performs a hash operation on the communication message to obtain a second digest;

[0153] The communication receiver compares the first digest and the second digest to see if they match. If they match, the authentication is successful.

[0154] In one or more embodiments, S4 further includes:

[0155] If the domain identifier information, terminal identifier information, and accompanying public key of the authentication protocol data packet are not empty, then cross-domain authentication is performed using the cross-domain authentication method; where cross-domain authentication refers to authentication between two drones belonging to different drone clusters.

[0156] The cross-domain authentication method specifically includes the following steps:

[0157] The communication receiver directly or indirectly inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs;

[0158] If the communication receiver is a member drone, the communication receiver sends the domain identifier information in the authentication protocol data packet to the cluster head drone in the same cluster. The cluster head drone inputs the information into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs. The cluster head drone then sends the domain identifier public key of the domain to which the communication initiator belongs to the communication receiver.

[0159] If the communication receiver is a cluster-headed UAV, the communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs.

[0160] The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key.

[0161] The communication receiver multiplies the identity of the communication initiator and the binding coefficient of the accompanying public key with the domain identifier public key of the domain to which the communication initiator belongs, and then adds it to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator.

[0162] The receiving party decrypts the signature using the public key of the terminal identifier of the initiator of the communication to obtain a third digest;

[0163] The communication receiver performs a hash operation on the communication message to obtain a fourth digest;

[0164] The communication receiver compares the third digest and the fourth digest to see if they match. If they match, the authentication is successful.

[0165] In one or more embodiments, S4 further includes:

[0166] If the domain identifier information of the authentication protocol data packet is not empty, the terminal identifier information is empty, and the accompanying public key is empty, then the inter-domain authentication method is used for inter-domain authentication; where inter-domain authentication refers to the authentication between the controller and the cluster head UAV.

[0167] The inter-domain authentication method is specifically as follows:

[0168] The communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs;

[0169] The receiving party decrypts the signature using the domain identifier public key of the domain to which the initiator of the communication belongs, and obtains the fifth digest;

[0170] The communication receiver performs a hash operation on the communication message to obtain a sixth digest;

[0171] The communication receiver compares the fifth digest and the sixth digest to see if they match. If they match, the authentication is successful.

[0172] In one or more embodiments, when a new drone is added to the drone swarm, the method described in S2 is used to generate a terminal identification key for the new drone; when a member drone leaves the drone swarm, the terminal identification information and accompanying public key of the leaving member drone are placed in a blacklist and sent to other member drones in the same cluster, so that the leaving member drone cannot pass the domain identity authentication. If the leaving member drone rejoins, the method described in S2 must be used to obtain the terminal identification key again.

[0173] In one or more embodiments, when the cluster leader drone is compromised, intra-domain authentication and secure communication are unaffected. The cluster leader drone is reassigned, requests a domain identifier key from the controller KMC, and securely distributes the new domain identifier public key to member drones within the domain, restoring cross-domain authentication and secure communication. When a member drone is compromised, the member drone only possesses its own complete identifier private key, and the identifier private keys of other drones are not leaked. Therefore, the leakage of a single identifier private key does not affect the entire drone swarm security system.

[0174] In a second aspect, an authentication system for a drone swarm is provided to implement the authentication method described in the first aspect, comprising a first computing and distribution unit, a second computing and distribution unit, a third computing and distribution unit, a fourth computing and distribution unit, and an authentication unit.

[0175] The first calculation and distribution unit is used to calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV;

[0176] The second calculation and distribution unit is used to calculate the domain identifier key of the controller based on the domain identifier information of the domain to which the controller belongs, and distribute it to the controller;

[0177] The third calculation and distribution unit is used to calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster.

[0178] The fourth calculation and distribution unit is used to calculate the terminal identification key of the cluster head drone based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the cluster head drone, and distribute it to the cluster head drone.

[0179] The authentication unit is used to receive authentication protocol data packets sent by the communication initiator, and to perform authentication based on the domain identification information, terminal identification information, and accompanying public key in the authentication protocol data packets by selecting a preset authentication method.

[0180] Thirdly, embodiments of the present invention also provide an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 301, a communications interface 302, a memory 303, and a communication bus 304, wherein the processor 301, the communications interface 302, and the memory 303 communicate with each other via the communication bus 304. The processor 301 can call logical instructions in the memory 303 to execute the UAV swarm authentication method provided in the first aspect.

[0181] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0183] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for authenticating a drone swarm, characterized in that, Includes the following steps: S1: Calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV; The domain identifier key of the controller is calculated based on the domain identifier information of the domain to which the controller belongs, and then distributed to the controller. S2: Calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster. The terminal identification key of the cluster head UAV is calculated based on the domain identification key of the domain to which the cluster head UAV belongs and the terminal identification information of the cluster head UAV, and then distributed to the cluster head UAV. S3: The communication receiver receives the authentication protocol data packet sent by the communication initiator; wherein, the authentication protocol data packet includes domain identification information, terminal identification information, accompanying public key, communication message and signature; the communication initiator is a cluster head UAV, a member UAV or a controller; the communication receiver is a cluster head UAV, a member UAV or a controller. The accompanying public key includes: multiplying the self-selected private key factor of the cluster member drone by the base point to obtain the self-selected public key factor of the cluster member drone; multiplying the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone; and adding the self-selected public key factor of the cluster member drone and the hidden public key factor of the cluster head drone to obtain the accompanying public key of the cluster member drone. Furthermore, the self-selected private key factor of the cluster head drone is multiplied by the base point to obtain the self-selected public key factor of the cluster head drone; the hidden private key factor of the cluster head drone is multiplied by the base point to obtain the hidden public key factor of the cluster head drone; and the self-selected public key factor and the hidden public key factor of the cluster head drone are added together to obtain the accompanying public key of the cluster head drone. S4: The communication receiver performs authentication based on the domain identifier information, terminal identifier information, and accompanying public key within the authentication protocol data packet, selecting a preset authentication method; specifically including: If the domain identifier information of the authentication protocol data packet is empty, the terminal identifier information is not empty, and the accompanying public key is not empty, then the intra-domain authentication method is used for intra-domain authentication; wherein, intra-domain authentication refers to authentication between two drones belonging to the same drone cluster; If the domain identifier information, terminal identifier information, and accompanying public key of the authentication protocol data packet are not empty, then cross-domain authentication is performed using the cross-domain authentication method; where cross-domain authentication refers to authentication between two drones belonging to different drone clusters. If the domain identifier information of the authentication protocol data packet is not empty, the terminal identifier information is empty, and the accompanying public key is empty, then the inter-domain authentication method is used for inter-domain authentication; where inter-domain authentication refers to the authentication between the controller and the cluster head UAV.

2. The method for authenticating a drone swarm according to claim 1, characterized in that, S1 specifically includes the following steps: The domain identifier information of the domain to which the cluster head UAV belongs is input into a query function defined by the key management center to obtain the domain identifier key of the domain to which the cluster head UAV belongs. Specifically, when the query function queries a private key matrix, the domain identifier private key of the domain to which the cluster head UAV belongs is obtained; when the query function queries a public key matrix, the domain identifier public key of the domain to which the cluster head UAV belongs is obtained. The domain identifier private key and the domain identifier public key of the domain to which the cluster head UAV belongs are combined to form the domain identifier key of the domain to which the cluster head UAV belongs.

3. The method for authenticating a drone swarm according to claim 1, characterized in that, S1 further includes the following steps: The domain identifier information of the domain to which the controller belongs is input into a query function defined by the key management center to obtain the domain identifier key of the controller; wherein, when the query function queries the private key matrix, the domain identifier private key of the controller is obtained; when the query function queries the public key matrix, the domain identifier public key of the controller is obtained; the domain identifier private key and the domain identifier public key of the controller are combined to form the domain identifier key of the controller.

4. The method for authenticating a drone swarm according to claim 2, characterized in that, S2 specifically includes the following steps: The association public key of the cluster member drone and the terminal identification information of the cluster member drone are concatenated, hashed, and then moduloed by the third value to obtain the identity and association public key binding coefficient of the cluster member drone; wherein, the third value is the order of the cyclic group of the base point; The first value is obtained by multiplying the identity of the cluster member drone with the accompanying public key binding coefficient and the domain identifier private key of the domain to which the cluster member drone belongs; wherein, the domain identifier private key of the domain to which the cluster member drone belongs is the same as the domain identifier private key of the domain to which the cluster head drone belongs in the same cluster. The first value, the self-selected private key factor of the drone in the same cluster, and the hidden private key factor of the drone in the cluster head are added together to obtain the second value. The second value is modulo the third value to obtain the terminal identifier private key of the drone in the same cluster; Multiply the private key of the terminal identifier of the drone in the same cluster by the base point to obtain the public key of the terminal identifier of the drone in the same cluster; wherein, the private key of the terminal identifier of the drone in the same cluster and the public key of the terminal identifier of the drone in the same cluster are combined to form the terminal identifier key of the drone in the same cluster.

5. The method for authenticating a drone swarm according to claim 2, characterized in that, S2 specifically includes the following steps: The association public key of the cluster head UAV and the terminal identification information of the cluster head UAV are concatenated, hashed, and then moduloed by the third value to obtain the binding coefficient between the identity of the cluster head UAV and the association public key; wherein, the third value is the order of the cyclic group of the base point. The fifth value is obtained by multiplying the identity of the cluster head drone with the accompanying public key binding coefficient and the domain identifier private key of the cluster head drone. The sixth value is obtained by adding the fifth value, the self-selected private key factor of the cluster head drone, and the hidden private key factor of the cluster head drone. The sixth value is modulo the third value to obtain the terminal identification private key of the cluster-head UAV; Multiply the terminal identifier private key of the cluster head UAV by the base point to obtain the terminal identifier public key of the cluster head UAV; wherein, the terminal identifier private key and the terminal identifier public key of the cluster head UAV are combined to form the terminal identifier key of the cluster head UAV.

6. The method for authenticating a drone swarm according to claim 1, characterized in that, The S4 intra-domain authentication method specifically includes the following steps: The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key. The communication receiver multiplies the identity of the communication initiator with the binding coefficient of the accompanying public key and the domain identifier public key of the domain to which the communication initiator belongs, and then adds the binding coefficient to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator; wherein, the domain identifier public key of the domain to which the communication initiator belongs is the same as the domain identifier public key of the domain to which the cluster head UAV in the same cluster belongs. The receiving party uses the public key of the terminal identifier of the initiator to decrypt the signature and obtain the first digest; The communication receiver performs a hash operation on the communication message to obtain a second digest; The communication receiver compares the first digest and the second digest to see if they match. If they match, the authentication is successful.

7. The method for authenticating a drone swarm according to claim 1, characterized in that, The cross-domain authentication method in S4 specifically includes the following steps: The communication receiver directly or indirectly inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs; If the communication receiver is a member drone, the communication receiver sends the domain identifier information in the authentication protocol data packet to the cluster head drone in the same cluster. The cluster head drone inputs the information into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs. The cluster head drone then sends the domain identifier public key of the domain to which the communication initiator belongs to the communication receiver. If the communication receiver is a cluster-headed UAV, the communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs. The communication receiver concatenates the accompanying public key and terminal identification information in the authentication protocol data packet and performs a hash operation to obtain the binding coefficient between the identity of the communication initiator and the accompanying public key. The communication receiver multiplies the identity of the communication initiator and the binding coefficient of the accompanying public key with the domain identifier public key of the domain to which the communication initiator belongs, and then adds it to the accompanying public key in the authentication protocol data packet to obtain the terminal identifier public key of the communication initiator. The receiving party decrypts the signature using the public key of the terminal identifier of the initiator of the communication to obtain a third digest; The communication receiver performs a hash operation on the communication message to obtain a fourth digest; The communication receiver compares the third digest and the fourth digest to see if they match. If they match, the authentication is successful.

8. The method for authenticating a drone swarm according to claim 1, characterized in that, The specific inter-domain authentication method in S4 is as follows: The communication receiver inputs the domain identifier information in the authentication protocol data packet into a local query function to obtain the domain identifier public key of the domain to which the communication initiator belongs; The receiving party decrypts the signature using the domain identifier public key of the domain to which the initiator of the communication belongs, and obtains the fifth digest; The communication receiver performs a hash operation on the communication message to obtain a sixth digest; The communication receiver compares the fifth digest and the sixth digest to see if they match. If they match, the authentication is successful.

9. An authentication system for a drone swarm, characterized in that, The method for implementing the authentication method according to any one of claims 1-8 includes a first computing distribution unit, a second computing distribution unit, a third computing distribution unit, a fourth computing distribution unit, and an authentication unit; The first calculation and distribution unit is used to calculate the domain identifier key of the domain to which the cluster head UAV belongs based on the domain identifier information of the domain to which the cluster head UAV belongs, and distribute it to the cluster head UAV; The second calculation and distribution unit is used to calculate the domain identifier key of the controller based on the domain identifier information of the domain to which the controller belongs, and distribute it to the controller; The third calculation and distribution unit is used to calculate the terminal identification key of the member drones in the same cluster based on the domain identification key of the domain to which the cluster head drone belongs and the terminal identification information of the member drones in the same cluster, and distribute it to the member drones in the same cluster. The fourth calculation and distribution unit is used to calculate the terminal identification key of the cluster head UAV based on the domain identification key of the domain to which the cluster head UAV belongs and the terminal identification information of the cluster head UAV, and distribute it to the cluster head UAV. The authentication unit is used to receive authentication protocol data packets sent by the communication initiator, and to perform authentication based on the domain identification information, terminal identification information, and accompanying public key in the authentication protocol data packets by selecting a preset authentication method. The accompanying public key includes: multiplying the self-selected private key factor of the cluster member drone by the base point to obtain the self-selected public key factor of the cluster member drone; multiplying the hidden private key factor of the cluster head drone by the base point to obtain the hidden public key factor of the cluster head drone; and adding the self-selected public key factor of the cluster member drone and the hidden public key factor of the cluster head drone to obtain the accompanying public key of the cluster member drone. Furthermore, the self-selected private key factor of the cluster head drone is multiplied by the base point to obtain the self-selected public key factor of the cluster head drone; the hidden private key factor of the cluster head drone is multiplied by the base point to obtain the hidden public key factor of the cluster head drone; and the self-selected public key factor and the hidden public key factor of the cluster head drone are added together to obtain the accompanying public key of the cluster head drone. The authentication process includes: if the domain identifier information of the authentication protocol data packet is empty, the terminal identifier information is not empty, and the accompanying public key is not empty, then intra-domain authentication is performed using an intra-domain authentication method; wherein, intra-domain authentication refers to authentication between two drones belonging to the same drone cluster; If the domain identifier information, terminal identifier information, and accompanying public key of the authentication protocol data packet are not empty, then cross-domain authentication is performed using the cross-domain authentication method; where cross-domain authentication refers to authentication between two drones belonging to different drone clusters. If the domain identifier information of the authentication protocol data packet is not empty, the terminal identifier information is empty, and the accompanying public key is empty, then the inter-domain authentication method is used for inter-domain authentication; where inter-domain authentication refers to the authentication between the controller and the cluster head UAV.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the authentication method for the drone swarm as described in any one of claims 1 to 8.

Images